Enquire

AL-TOUCH / SECURITY BRIEF

Security brief | 2026-10-23

Brand updates, public security notices and practical business actions, collected weekly.

Every Friday09:00 · Hong Kong time

Automatic public-source selection · source and licence links included

This edition: major vulnerabilities and fixes

Critical · source ratingCVE-2026-114625 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-110243 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingMilvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System CompromiseVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • go / github.com/milvus-io/milvusAffected < 2.5.27Fixed version 2.5.27
  • go / github.com/milvus-io/milvusAffected >= 2.6.0, < 2.6.10Fixed version 2.6.10

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical · source ratingNext.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arraysVersions and remediation

GitHub Advisory Database · Source updated

Affected / fixed versions

  • npm / nextAffected >= 16.0.0,Fixed version 16.4.1

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-4.0

Critical warning · source headline[Security Blog] HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further ShoVersions and remediation

HKCERT · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC-BY-3.0-HK

Critical · PHP security advisoryCritical security issue affecting PHPVersions and remediation

UK NCSC · Source updated

Affected / fixed versions

  • PHP 8.2.xAffected < 8.2.35Fixed version 8.2.35
  • PHP 8.3.xAffected < 8.3.36Fixed version 8.3.36
  • PHP 8.4.xAffected < 8.4.27Fixed version 8.4.27
  • PHP 8.5.xAffected < 8.5.12Fixed version 8.5.12

Remediation

Update the relevant PHP branch to the listed fixed release or a later supported security release, then restart all workers and verify the web runtime. PHP 8.1 and older require a supported upgrade or a confirmed vendor backport.

Match these source records to your assets; publication does not mean your systems are affected.

Version details manually checked: 2026-10-22 · Refer to the latest vendor advisory

Original advisory ↗PHP security advisory ↗CVE-2026-109618 ↗CVE-2026-109619 ↗

Compiled / adapted by AL-Touch · Open Government Licence v3.0

Does your website need PHP patches or an upgrade?

Start with a version review, backups and compatibility tests, then arrange patches, a website rebuild or maintenance as needed.

Explore PHP website reviews and upgrades →
Use the PHP2Shell online version checker →
Known exploited · CISA KEVCVE-2026-106931 | EG Secure Solutions SiteGuard Server EditionVersions and remediation

CISA KEV · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Prioritise exposed assets. Apply vendor fixes or mitigations; restrict access or discontinue the affected product if no mitigation is available. CISA federal-agency directives are not Hong Kong statutory deadlines.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC0-1.0

Known exploited · CISA KEVCVE-2026-96656 | Plex Media ServerVersions and remediation

CISA KEV · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Prioritise exposed assets. Apply vendor fixes or mitigations; restrict access or discontinue the affected product if no mitigation is available. CISA federal-agency directives are not Hong Kong statutory deadlines.

Match these source records to your assets; publication does not mean your systems are affected.

Original advisory ↗

Compiled / adapted by AL-Touch · CC0-1.0

Critical · source ratingCVE-2026-110063 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-107861 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-105014 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

Critical · source ratingCVE-2026-97785 | NVD vulnerability recordVersions and remediation

NIST NVD · Source updated

Affected / fixed versions

Affected versions were not specified by the source. Check the vendor advisory before acting.

Remediation

Check the vendor advisory and your actual deployment. Apply the supported security update and verify the running version after restart. If no fix is available, follow vendor mitigations and restrict exposure.

NVD product/version matches are candidates. Check the original configuration conditions (AND/OR, platform and deployment); a range endpoint is not a confirmed patched version.

Original advisory ↗

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

ISSUE 2026.10.23

A selection from approved public-source feeds over the previous seven days, with original links, dates and practical follow-up.

Coverage2026-10-16 — 2026-10-23
Read this edition ↓
Original network and data-security concept illustration
Original concept illustration · not an incident photograph
Key takeaway

Match notices to your assets, confirm vendor guidance, and prioritise patching and recovery readiness.

01
Vulnerabilities and updates

CVE-2026-114625 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

02
Vulnerabilities and updates

CVE-2026-110243 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

03
Vulnerabilities and updates

Milvus: Unauthenticated Access to Restful API on Metrics Port (9091) Leads to Critical System Compromise

GitHub Advisory Database lists GHSA-7ppg-37fh-vcr6 for package github.com/milvus-io/milvus, with affected range < 2.5.27.

Compiled / adapted by AL-Touch · CC-BY-4.0

04
Vulnerabilities and updates

Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays

GitHub Advisory Database lists GHSA-673q-mjm6-r5xr for package next, with affected range >= 16.0.0,.

Compiled / adapted by AL-Touch · CC-BY-4.0

05
Vulnerabilities and updates

[Security Blog] HKCERT Warns of Critical “PHP2Shell” Vulnerabilities: Businesses Must Immediately Review and Patch PHP Systems AI Accelerates Cyber Attacks and Defence, Further Sho

HKCERT published or updated this public security item on 2026-10-21. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · CC-BY-3.0-HK

06
Security information

Critical security issue affecting PHP

UK NCSC published or updated this public security item on 2026-10-21. The original title and link are retained for verification.

Compiled / adapted by AL-Touch · Open Government Licence v3.0

07
Vulnerabilities and updates

CVE-2026-106931 | EG Secure Solutions SiteGuard Server Edition

CISA added CVE-2026-106931 to its known exploited vulnerabilities catalogue on 2026-10-20. The affected product is EG Secure Solutions SiteGuard Server Edition.

Compiled / adapted by AL-Touch · CC0-1.0

08
Vulnerabilities and updates

CVE-2026-96656 | Plex Media Server

CISA added CVE-2026-96656 to its known exploited vulnerabilities catalogue on 2026-10-20. The affected product is Plex Media Server.

Compiled / adapted by AL-Touch · CC0-1.0

09
Vulnerabilities and updates

CVE-2026-110063 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

10
Vulnerabilities and updates

CVE-2026-107861 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

11
Vulnerabilities and updates

CVE-2026-105014 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

12
Vulnerabilities and updates

CVE-2026-97785 | NVD vulnerability record

NVD published this record on 2026-10-22 and last updated it on 2026-10-22.

Compiled / adapted by AL-Touch · NIST non-SRD data public-service reuse grant

READ / REVIEW / ACT

Turn information into practical improvements

Publication dates may differ from incident dates. Apply recommendations to the actual versions, systems and risks in your environment.

88-question security assessment →Discuss business security →
Sources, licences and permitted use

GovCERT.HK ↗ · Reference link / review required

HKCERT ↗ · Approved automatic source · CC-BY-3.0-HK

PCPD ↗ · Reference link / review required

Hong Kong Monetary Authority ↗ · Reference link / review required

Securities and Futures Commission ↗ · Reference link / review required

Hong Kong Police CyberDefender ↗ · Reference link / review required

CISA KEV ↗ · Approved automatic source · CC0-1.0

UK NCSC ↗ · Approved automatic source · Open Government Licence v3.0

Australian Cyber Security Centre ↗ · Reference link / review required

Singapore CSA / SingCERT ↗ · Reference link / review required

JPCERT/CC ↗ · Reference link / review required

CERT-EU ↗ · Reference link / review required

ANSSI / CERT-FR ↗ · Approved automatic source · Licence Ouverte / Open Licence v2.0

Canadian Centre for Cyber Security ↗ · Reference link / review required

New Zealand NCSC ↗ · Reference link / review required

CNCERT/CC ↗ · Reference link / review required

CERT-In ↗ · Reference link / review required

FBI / IC3 ↗ · Reference link / review required

NIST NVD ↗ · Approved automatic source · NIST non-SRD data public-service reuse grant

CVE Program ↗ · Reference link / review required

FIRST EPSS ↗ · Reference link / review required

CERT/CC ↗ · Reference link / review required

OWASP Foundation ↗ · Reference link / review required

GitHub Advisory Database ↗ · Approved automatic source · CC-BY-4.0

Microsoft MSRC ↗ · Reference link / review required

Google Cloud Security Bulletins ↗ · Approved automatic source · CC-BY-4.0

Apple Security Releases ↗ · Reference link / review required

Cisco PSIRT ↗ · Reference link / review required

Fortinet FortiGuard PSIRT ↗ · Reference link / review required

Palo Alto Networks PSIRT ↗ · Reference link / review required

Mozilla Security Advisories ↗ · Reference link / review required

Ivanti Security Advisory ↗ · Reference link / review required

Broadcom / VMware Security Advisories ↗ · Reference link / review required

Dell Security Advisories ↗ · Reference link / review required

HPE Security Bulletins ↗ · Reference link / review required

Lenovo Product Security ↗ · Reference link / review required

Oracle Security Alerts ↗ · Reference link / review required

Synology Security Advisories ↗ · Reference link / review required

Veeam Knowledge Base ↗ · Reference link / review required

WebRAY ↗ · Reference link / review required

Huorong Security ↗ · Reference link / review required

ToDesk ↗ · Reference link / review required

Adobe PSIRT ↗ · Reference link / review required

GlobalSign ↗ · Reference link / review required

xFusion PSIRT ↗ · Reference link / review required

Zenarmor Release Notes ↗ · Reference link / review required

The Hacker News ↗ · Reference link / review required

BleepingComputer ↗ · Reference link / review required

SecurityWeek ↗ · Reference link / review required

Hacker News community ↗ · Reference link / review required

Compiled by AL-Touch · each item links to its original source. This is the website edition; email delivery is arranged separately.